Apache Karaf allows a caller with the manager role to write arbitrary configuration files by exploiting a path traversal flaw in the ConfigRepositoryImpl.update method. The flaw occurs when a property map contains a felix.fileinstall.filename entry or when the configuration PID itself contains ".." segments, allowing the resulting file path to reference any location writable by the Karaf process. By writing to critical system files such as users.properties, ACL configurations, or management settings, an attacker can grant themselves admin rights or otherwise hijack the container’s security model. This is a classic example of file path manipulation (CWE-22) that directly impacts integrity and confidentiality of the system administrator controls.

The vulnerability affects the Apache Karaf platform. All installed instances that have not applied a patch for the path traversal flaw in the config service are potentially impacted. No specific version information is provided, so any deployment of Apache Karaf that relies on the vulnerable ConfigRepositoryImpl code is at risk.

The CVSS score of 9.8 indicates critical severity, while the EPSS score of less than 1% suggests exploitation is unlikely but possible. The vulnerability is not listed in CISA’s KEV catalog. Because the flaw is exercised via the “config” MBean and config:* shell commands, an attacker needs access to a Karaf process with the manager role, typically through JMX or local command execution. The likely attack vector is remote JMX access if enabled, although local exploitation is also feasible if an attacker gains file or command line access to the Karaf instance.